tge-firelight[.]com

The domain tge-firelight.com was registered on May 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently hosted behind Cloudflare’s network (IP 104.21.65.223, located in Canada). The authoritative nameservers are nelly.ns.cloudflare.com and rudy.ns.cloudflare.com, and the site presents a valid Let's Encrypt certificate (E8). HTTP requests return a 403 status, a pattern often observed in malicious credential‑harvesting pages that block direct access while serving content to specific user agents.

Infrastructure analysis shows the domain appears on three external security blocklists and receives a Gridinsoft trust score of 0 out of 100, indicating a high likelihood of abuse. VirusTotal scans report that five of ninety‑five scanning engines flag the domain as malicious, and it is actively blocked by PhishDestroy, MetaMask, and SEAL. These independent detections reinforce the assessment that tge-firelight.com is being leveraged for a generic phishing campaign.

Publicly observable evidence does not reveal the exact brand or service being spoofed, and no payload samples have been released. Consequently, the specific lure (e.g., login portal, payment gateway) remains uncertain, though the combination of a legitimate TLS certificate, Cloudflare fronting, and a 403 response aligns with typical credential‑stealing infrastructure.

Defenders should add tge-firelight.com to network and endpoint blocklists, enforce DNS filtering, and monitor outbound connections to the associated Cloudflare IP address. Email gateways should be tuned to flag messages containing URLs that resolve to 104.21.65.223, especially if paired with social engineering cues. Continuous re‑evaluation is advised, as the domain remains active and may evolve its tactics.